01
Source code
Start with exposed secrets and vulnerable dependencies in an explicitly approved repository and revision.
- → Planned for the first pilot
- → Scoped repository access
- → Redacted findings
AI CYBERSECURITY · IN DEVELOPMENT
Security testing and remediation for fintech teams.
Attack. Fix. Prove it.
Bracemont is an AI cybersecurity platform in development for regulated companies and fintech. AI agents are meant to carry the repetitive security work—testing, triage, fix proposals and re-tests—while people approve scope, risky tests, merges and anything published.
Read our researchSource code and staging first · Founder-operated pilots
The workflow we’re building
From an agreed scope to a reviewed result.
- 01
Test
Check an agreed source revision or staging target, within a signed scope.
- 02
Verify
Record what was observed and how it was checked. Keep unconfirmed findings separate.
- 03
Fix
Propose remediation or a narrow pull request. A person reviews and merges it.
- 04
Re-test
Check the fix on a named revision and environment. Track deployment separately.
- 05
Evidence
Prepare a traceable report. A person approves it before it is shared.
A focused first release.
The first security loop is in development. We’ll validate it on Tolaron’s own systems before accepting a client target.
02
Staging
Add bounded checks against an agreed web application or API, with test accounts, exclusions and a stop procedure.
- → Planned for the first pilot
- → Agreed targets and time window
- → Production excluded by default
03
Fixes & evidence
Deliver remediation proposals, eligible fix PRs, re-test results and a report that explains the limits of the assessment.
- → Planned for the first pilot
- → Human review and merge
- → Evidence tied to a revision
Later roadmap: AI-agent and MCP testing, mobile testing and control mappings. These are not available services today.
DEVELOPMENT PREVIEW · OCTOBER 2026
A workspace for accountable testing.
The local console already brings projects, scope approvals, test runs and evidence reviews together. Offline OSV and Gitleaks checks work on prepared demo code. Imported-file scanning is implemented with a separate worker setup requirement. The complete fix-and-re-test loop is still being built.
01 / PROJECT WORKFLOW
One project. One exact starting point.
Choose prepared demo code or import an allowed GitHub repository at a full commit. Source, checks and authorization stay in one setup flow.
Project sourceExact repository revisionImport available
Import validates file identity. Scanning requires a configured separate worker and an approved exact plan.
Available in the local preview
- Guided project setup
- OSV + Gitleaks on demo code
- Exact-commit repository import
- Repository scans · separate worker setup required
- Human review & JSON evidence
The next capabilities
Planned capabilities are not available in the current release. Pilot dates depend on readiness.
Fix pull requests
Propose a bounded change, re-test it, and leave the merge to a person.
Scheduled checks
Repeat checks within an approved scope and time window.
Web & API testing
Inspect authorized staging targets with enforced network limits.
AI & mobile testing
Add accepted adapters for AI systems and mobile applications.
Newsroom
Draft sourced research and incident entries for editorial approval.
Define the boundary
Record the target, environment, time window and limits before work begins.
Keep decisions visible
Review scope and evidence approvals alongside the work they authorize.
Follow the result
Keep runs and report snapshots attached to the project. Inspect observations, record a reasoned review, and approve an exact evidence export.
THE AUTOMATION MODEL
Four decisions stay with people.
Routine work is intended to run automatically within an approved scope. These are the boundaries of that design, including features still in development.
- 01
Authorize the scope
A named person approves targets, methods, limits and the time window. A changed or expired scope needs a new approval.
- 02
Approve risky tests
A production or potentially destructive test needs approval of its exact plan before it can run.
- 03
Review and merge
Bracemont is being built to propose and re-test fixes. A person decides whether to merge.
- 04
Approve publication
A person reviews the exact report or article before it is shared with an external reader.
ILLUSTRATIVE DELIVERABLE · SYNTHETIC EXAMPLE
What a finding should tell you.
A useful report connects the observation, the proposed change and the result of checking it. This example shows the intended format; no security test was run to produce it.
EXAMPLE-001
Illustrative onlyMissing ownership check on an invoice endpoint
- Affected component
- Example invoice API · GET /invoices/:id · staging · revision demo-before
- Observation
- The scenario assumes that a test account can read an invoice belonging to another test account. All identities and records in this example are synthetic.
- Verification method
- Proposed check: compare the owner’s request with a second account’s request for the same synthetic invoice. Record response codes and redacted evidence.
- Remediation
- Enforce the authenticated account’s ownership on the server before returning the invoice. Submit the change for human review.
- Re-test result
- Illustrated expected result at demo-after: the owner receives 200; the other account receives 403. These are example values, not observed test results.
- Supporting evidence
- The intended report would attach the approved scope, revisions, redacted request/response pairs, test logs and the reviewer’s decision. No such artifacts are asserted here.
- Closure
- Deployment remains unverified. A passing staging re-test alone would not establish that production was fixed.
PRIVATE PILOTS · REGISTER INTEREST
A small first cohort.
Built with you.
For regulated companies, fintechs and the software suppliers that serve them, especially teams without a dedicated security team. Initial engagements will be operated by Bracemont’s founder.
What an initial engagement would involve
- Discuss the fit
After you register interest, we’ll review your needs and follow up by email. Joining does not reserve a start date.
- Agree the boundaries
Before testing, agree a repository or staging target, limited access, test accounts, exclusions, data handling and a written authorization.
- Review the outcome
Receive findings with their verification status, remediation proposals, re-test results where completed, and an approved report.
Internal testing is targeted for November 2026, with initial client tests targeted for December. Both depend on readiness checks; these are planning targets, not confirmed availability.
Registering interest does not authorize a scan. Please do not send credentials, source code or sensitive findings through this form.
Before we work together.
Can I start a scan now?
No. The platform is in development and the current console is for internal use. The waitlist is for discussing future founder-operated pilots.
What access would you need?
Only access agreed for the engagement: a specific repository or source snapshot, or an authorized staging target and test accounts. Exact permissions and revocation are agreed before testing.
Will you test production or merge code?
Production is excluded by default. Risky tests need separate, explicit approval of a bounded plan. A human reviews and merges every proposed fix.
Where will our code and findings go?
Hosting and model-provider choices for client assessments are still being evaluated. We will agree providers, processing locations, retention and any AI use with you before access is granted.
Is this a certification or a formal threat-led pentest?
No. The planned service produces testing evidence for review. It does not certify compliance or replace an auditor, certification body or qualified threat-led penetration-testing engagement.
What will a pilot cost?
Pilot pricing is not set. Scope, deliverables and price will be agreed before an engagement begins. Registering interest creates no payment obligation.
Built inside Tolaron.
Bracemont is a venture of Tolaron s.r.o., a software company based in Prague. We’re starting with the systems we build and operate ourselves. The founder will run initial engagements and review their results with clients.